Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAG

Inderjeet Singh; Vikas Pahuja; Aishvariya Priya Rathina Sabapathy; Chiara Picardi; Amit Giloni; Roman Vainshtein; Andrés Murillo; Hisashi Kojima

cs.CRFeb 24, 2026

Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAG

Authors: Inderjeet Singh, Vikas Pahuja, Aishvariya Priya Rathina Sabapathy, Chiara Picardi, Amit Giloni, Roman Vainshtein, Andrés Murillo, Hisashi Kojima, +3 more

Organizations: Fujitsu Research of Europe, UK · Fujitsu Limited, Japan

Abstract

Current stateless defences for multimodal agentic RAG fail to detect adversarial strategies that distribute malicious semantics across retrieval, planning, and generation components. We formulate this security challenge as a Partially Observable Markov Decision Process (POMDP), where adversarial intent is a latent variable inferred from noisy multi-stage observations. We introduce MMA-RAG^T, an inference-time control framework governed by a Modular Trust Agent (MTA) that maintains an approximate belief state via structured LLM reasoning. Operating as a model-agnostic overlay, MMA-RAGT mediates a configurable set of internal checkpoints to enforce stateful defence-in-depth. Extensive evaluation on 43,774 instances demonstrates a 6.50x average reduction factor in Attack Success Rate relative to undefended baselines, with negligible utility cost. Crucially, a factorial ablation validates our theoretical bounds: while statefulness and spatial coverage are individually necessary (26.4 pp and 13.6 pp gains respectively), stateless multi-point intervention can yield zero marginal benefit under homogeneous stateless filtering when checkpoint detections are perfectly correlated.

Figures & tables

Figure 1: The MMA-RAG ${}^{\textsc{T}}$ architecture. The MTA ( $\mathcal{A}_{\mathrm{trust}}$ ) intercepts artifacts at a set of checkpoints ( C1 - C5 in our evaluated instantiation), executes Algorithm 1 at each, and maintains a cumulative belief state $\Phi_{t}$ . Decisions $\delta_{t}\!\in\!\{\textup{{Approve}},\textup{{Mitigate}},\textup{{Refuse}}\}$ gate artifact passage through the pipeline.

Configuration	CR $\uparrow$	AR $\uparrow$
ColBERTv2 + GPT-4	0.90	0.82
DPR + BART	0.62	0.58
Agentic RAG (baseline)	0.88	0.93
MMA-RAG ${}^{\textsc{T}}$ (+ MTA )	0.87	0.93

Table 1: Utility on Natural Questions (dev,

n\!=\!3{,}610

). ARES scores (context relevance CR, answer relevance AR). Established baselines from Saad-Falcon et al. (2023) included for reference. Differences between the baseline and MMA-RAG

{}^{\textsc{T}}

are small.

Benchmark	Baseline	+ MTA	Red.
B1: Text poisoning	76.5	15.7	$4.87\!\times$
B2a: Image (OCR)	22.3	2.0	$11.15\!\times$
B2b: Image (MM)	10.1	5.5	$1.84\!\times$
B3: Direct query	59.0	4.1	$14.39\!\times$
B4: Tool-flip	82.1	63.5	$1.29\!\times$
B5: Agentic integrity	48.5	8.9	$5.45\!\times$

Table 2: ASR (%,

\downarrow

) across ART-SafeBench benchmarks with GPT-4o backbone. Reduction factor

=

baseline ASR / defended ASR. Avg. (factor) is the unweighted mean of per-benchmark reduction factors.

Figure 2: Experimental results overview. (a) ASR across all ART-SafeBench benchmarks: the MTA reduces ASR on every surface, with reduction factors ranging from $1.3\times$ (B4, tool-flip) to $14.4\times$ (B3, direct query); mean factor $6.50\times$ . (b) Factorial ablation on B1: statefulness contributes $-26.4$ pp and multi-stage coverage $-13.6$ pp; the two mechanisms are individually necessary and their combination yields super-additive gains, validating Propositions 1 and 2 . (c) Cross-LLM generalisation on B1: defence transfers across four backbones ( $2.5\!\times$ - $9.5\!\times$ reduction), with invariant relative difficulty ordering.

Configuration	ASR $\downarrow$	$\boldsymbol{\Delta}$ pp	Refusals
No MTA (baseline)	76.5	+19.8	-
Stateless, final-only	56.7 †	0.0 †	-
Stateful, final-only	43.9	$-12.8$	18
Stateless, multi-stage	56.7	ref.	45
Stateful, multi-stage	30.3	$\mathbf{-26.4}$	42

Table 3: Ablation on B1 (%). Stateful : belief state maintained across checkpoints. Multi-stage : all C1-C5.

\Delta

pp: change vs. stateless, multi-stage (ref.). Refusals: total MTA block actions per evaluation run.

\dagger

Implied by Proposition 2 (i); not independently measured. Stateless configurations structurally model existing boundary-filter paradigms.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

LLM Backbone	Base	+ MTA	Red.
GPT-4o	76.5	15.7	$4.9\!\times$
GPT-4o-mini	78.4	31.5	$2.5\!\times$
Llama-3.3-70B	70.9	7.5	$9.5\!\times$
GPT-4.1	78.0	14.0	$5.6\!\times$

Appendix

Table 4: Per-LLM end-to-end ASR (%) and reduction factors for B1 (Text Poisoning), varying the protected backbone while keeping the trust layer fixed.

OWASP Category	$n$	Base	+ MTA
Prompt injection (LLM01)	1,477	64	8
Insecure output (LLM05)	716	71	$<$ 1
Sensitive info. (LLM02)	715	36	0
Supply chain (LLM03)	623	58	0
Misinfo./harmful (LLM09)	738	63	5
Model DoS (LLM10)	709	61	7

Appendix

Table 5: Per-OWASP ASR (%) for B3 for the six instantiated categories (

n\!=\!4{,}978

of 10,005). Information disclosure (LLM02) and supply-chain (LLM03) attacks are eliminated entirely.

Explore similar work

Adaptive Defense Orchestration for RAG: A Sentinel-Strategist Architecture against Multi-Vector Attacks
Apr 22, 2026Pranav Pallerla, Wilson Naik Bhukya, Bharath Vemula +1Autonomous Cyber Defense RAG Security
School of Computer and Information Sciences University of Hyderabad Hyderabad, Telangana, India · Purdue University West Lafayette, USA
MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG
Jun 25, 2026Inderjeet Singh, Andrés Murillo, Motoyoshi Sekiya +2Multimodal RAG Tool-Augmented Language Model Agents
Fujitsu Research of Europe, United Kingdom · Fujitsu Limited, Japan
RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation
Aug 25, 2026Yueyang Quan, Anjun Gao, Yufei Xia +2RAG Security RAG Robustness
University of North Texas · University of Louisville

Apr 22, 2026J/K move · Enter open · S save

Adaptive Defense Orchestration for RAG: A Sentinel-Strategist Architecture against Multi-Vector Attacks

Pranav Pallerla, Wilson Naik Bhukya, Bharath Vemula, Charan Ramtej Kodi

School of Computer and Information Sciences University of Hyderabad Hyderabad, Telangana, India · Purdue University West Lafayette, USA

Autonomous Cyber Defense RAG Security

Open paper AskPDF arXiv

Retrieval-augmented generation (RAG) systems are increasingly deployed in sensitive domains such as healthcare and law, where they rely on private, domain-specific knowledge. This capability introduces significant security risks, including membership inference, data poisoning, and unintended content leakage. A straightforward mitigation is to enable all relevant defenses simultaneously, but doing so incurs a substantial utility cost. In our experiments, an always-on defense stack reduces contextual recall by more than 40%, indicating that retrieval degradation is the primary failure mode. To mitigate this trade-off in RAG systems, we propose the Sentinel-Strategist architecture, a context-aware framework for risk analysis and defense selection. A Sentinel detects anomalous retrieval behavior, after which a Strategist selectively deploys only the defenses warranted by the query context. Evaluated across three benchmark datasets and five orchestration models, ADO is shown to eliminate MBA-style membership inference leakage while substantially recovering retrieval utility relative to a fully static defense stack, approaching undefended baseline levels. Under data poisoning, the strongest ADO variants reduce attack success to near zero while restoring contextual recall to more than 75% of the undefended baseline, although robustness remains sensitive to model choice. Overall, these findings show that adaptive, query-aware defense can substantially reduce the security-utility trade-off in RAG systems.

Abstract

Explore similar work

Adaptive Defense Orchestration for RAG: A Sentinel-Strategist Architecture against Multi-Vector Attacks

MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG

RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation